session garbage collection problem

[pqdrummer]

Okay, let me start by apologizing if this has been asked 100 times before.

 

I have a custome ecommerce program that is storing various data in session.  The problem that we are having is that every now and then a customer's session information is lost while they are using the site.  I currently have session.gc_maxlifetime set to 28800.  However, from what I've been able to gather from random internet posts, all this does is indicate that the garbage collection routine can run as long as there is a session file that is at least 8 hours old (whether or not it actually runs depends on the probability that is set).  Is that correct?

 

If it is, then that's where my problem lies.  This application is (obviously) being used constantly throughout the day.  This means that it is more than likely that there will eventually be session files that are at least 8 hours old.  As a result, the 8-hours-old session file could trigger a garbage collection which would delete a brand new session file that I don't want to be deleted.  I have tried storing each session file in its own folder so that they don't all get grabbed by the global GC, but all that does is create a new folder each time I hit a call to session_start(), thereby not maintaining any session persistance.

 

If anyone knows a way to make it so that only session files that are older than a specified age are deleted by the GC, it would be GREATLY appreciated if you share that info with me.  Much thanks in advance.

[revraz]

Active sessions will not be purged by the GC unless you have the session to expire too short.  Only expired Session get destroyed by the GC.

[pqdrummer]

Active sessions will not be purged by the GC unless you have the session to expire too short.  Only expired Session get destroyed by the GC.

 

Well how do I set the expriration length then?  Everything that I read regarding session timeout/expiration had to do with the gc_maxlifetime.

[PFMaBiSmAd]

Some of what you stated is backward. Having a session data file older than session.gc_maxlifetime is not what triggers GC (garbage collection.)

 

On every session_start(), session.gc_probability and session.gc_divisor are used to randomly run GC. Any session data files that have a "last access time" older than session.gc_maxlifetime will be deleted.

 

To solve your problem, you need to first find out what is causing the problem. Is this on a shared hosting server?

 

Edit: And where have you set session.gc_maxlifetime and have you confirmed using a phpinfo() statement that it is actually set?

[pqdrummer]

Some of what you stated is backward. Having a session data file older than session.gc_maxlifetime is not what triggers GC (garbage collection.)

 

On every session_start(), session.gc_probability and session.gc_divisor are used to randomly run GC. Any session data files that have a "last access time" older than session.gc_maxlifetime will be deleted.

 

To solve your problem, you need to first find out what is causing the problem. Is this on a shared hosting server?

 

My company owns the server, so I have root access, if that's what you're getting at.  We use the same server for a bunch of different clients/sites though (and all session data from all sites is save to the same /tmp directory).  So from my perspective, no, it's not a shared server.  But from our clients' perspective it would be.

[PFMaBiSmAd]

I edited my post above, how about this information -

Edit: And where have you set session.gc_maxlifetime and have you confirmed using a phpinfo() statement that it is actually set?

[pqdrummer]

I edited my post above, how about this information -

Edit: And where have you set session.gc_maxlifetime and have you confirmed using a phpinfo() statement that it is actually set?

 

I am setting the session.gc_maxlifetime via ini_set in a file that is included at the beginning of every php file.  I have confirmed the value via phpinfo.  I know that it is being set to 8 hours.  However, the other day there was a customer that was online for about 2 hours (inactive for about 1 hour) whos session was lost.  I could understand that if GC worked like how I explained it.  But if what you said is true, I have no idea how that could have happened and I am back to square one.

[revraz]

Why not set it in the PHP.INI directly?

[pqdrummer]

Why not set it in the PHP.INI directly?

 

Because about 50 sites share the same php.ini

[PFMaBiSmAd]

The shortest setting of all the scripts on all the sites will win.

 

To insure that your setting only applies to your session data files, requires that you use a session.save_path setting to cause your session data files to be placed in a folder that is separate from the session data files of the other sites.

[pqdrummer]

The shortest setting of all the scripts on all the sites will win.

 

That must be what's causing the problem.  I can almost guarantee that we have other sites with shorter session settings.

 

To insure that your setting only applies to your session data files, requires that you use a session.save_path setting to cause your session data files to be placed in a folder that is separate from the session data files of the other sites.

 

I'll give that a shot and see how it goes.  Thanks!

[revraz]

Maybe you can use the sub folder option?

 

; Argument passed to save_handler.  In the case of files, this is the path

; where data files are stored. Note: Windows users have to change this

; variable in order to use PHP's session functions.

;

; As of PHP 4.0.1, you can define the path as:

;

;    session.save_path = "N;/path"

;

; where N is an integer.  Instead of storing all the session files in

; /path, what this will do is use subdirectories N-levels deep, and

; store the session data in those directories.  This is useful if you

; or your OS have problems with lots of files in one directory, and is

; a more efficient layout for servers that handle lots of sessions.

;

; NOTE 1: PHP will not create this directory structure automatically.

;        You can use the script in the ext/session dir for that purpose.

; NOTE 2: See the section on garbage collection below if you choose to

;        use subdirectories for session storage

;